Skip to content

Commit 9d21ce7

Browse files
JelleZijlstraJelleZijlstra
authored
Merge branch 'main' into psutil-ntuples-types
2 parents 84ef030 + 24aa422 commit 9d21ce7

186 files changed

Lines changed: 2276 additions & 869 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/renovate.json5‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,15 @@
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
33
"dependencyDashboard": true,
44
"suppressNotifications": ["prEditedNotification"],
5-
"extends": ["config:recommended"],
5+
"extends": [
6+
"config:recommended",
7+
"helpers:pinGitHubActionDigestsToSemver",
8+
"replacements:all",
9+
"abandonments:recommended"
10+
],
11+
"configMigration": true,
612
"labels": ["bot: dependencies"],
7-
"rebaseLabel": ["bot: rebase"],
13+
"rebaseLabel": "bot: rebase",
814
"semanticCommits": "disabled",
915
"separateMajorMinor": false,
1016
"prHourlyLimit": 10,
@@ -15,7 +21,13 @@
1521
"pre-commit": {
1622
"enabled": true
1723
},
24+
"minimumReleaseAge": "7 days",
1825
"packageRules": [
26+
{
27+
// Pin versions already in use without waiting for the upgrade cooldown.
28+
"matchUpdateTypes": ["pinDigest"],
29+
"minimumReleaseAge": null
30+
},
1931
{
2032
groupName: "GitHub Actions",
2133
matchManagers: ["github-actions"],

‎.github/workflows/actionlint.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Lint GitHub Actions workflows
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- ".github/workflows/**"
10+
pull_request:
11+
paths:
12+
- ".github/workflows/**"
13+
14+
permissions:
15+
contents: read
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
19+
cancel-in-progress: true
20+
21+
jobs:
22+
actionlint:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
with:
27+
persist-credentials: false
28+
- name: Run actionlint
29+
# This is the recommended way to run actionlint in CI:
30+
# https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions.
31+
# The actionlint pre-commit hook would be an alternative,
32+
# but it causes our pre-commit CI jobs to time out.
33+
# The Docker image includes ShellCheck and Pyflakes.
34+
uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
35+
with:
36+
args: -color -verbose

‎.github/workflows/daily.yml‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,11 @@ jobs:
4343
fail-fast: false
4444

4545
steps:
46-
- uses: actions/checkout@v7
46+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
47+
with:
48+
persist-credentials: false
4749
- name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
48-
uses: actions/setup-python@v6
50+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
4951
with:
5052
python-version: ${{ matrix.python-version }}
5153
cache: pip
@@ -67,8 +69,10 @@ jobs:
6769
shard-index: [0, 1, 2, 3]
6870
fail-fast: false
6971
steps:
70-
- uses: actions/checkout@v7
71-
- uses: actions/setup-python@v6
72+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
73+
with:
74+
persist-credentials: false
75+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
7276
with:
7377
python-version: "3.13"
7478
cache: pip
@@ -82,19 +86,24 @@ jobs:
8286
run: |
8387
PACKAGES=$(python tests/get_stubtest_system_requirements.py)
8488
89+
# System package names contain no whitespace or glob characters, so word splitting is intentional.
90+
# shellcheck disable=SC2086
8591
if [ "${{ runner.os }}" = "Linux" ]; then
8692
if [ -n "$PACKAGES" ]; then
87-
printf "Installing APT packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
93+
printf 'Installing APT packages:\n'
94+
printf ' %s\n' $PACKAGES
8895
sudo apt-get update -q && sudo apt-get install -qy $PACKAGES
8996
fi
9097
else
9198
if [ "${{ runner.os }}" = "macOS" ] && [ -n "$PACKAGES" ]; then
92-
printf "Installing Homebrew packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
99+
printf 'Installing Homebrew packages:\n'
100+
printf ' %s\n' $PACKAGES
93101
brew install -q $PACKAGES
94102
fi
95103
96104
if [ "${{ runner.os }}" = "Windows" ] && [ -n "$PACKAGES" ]; then
97-
printf "Installing Chocolatey packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
105+
printf 'Installing Chocolatey packages:\n'
106+
printf ' %s\n' $PACKAGES
98107
choco install -y $PACKAGES
99108
fi
100109
fi
@@ -115,15 +124,17 @@ jobs:
115124
runs-on: ubuntu-latest
116125
steps:
117126
- name: Checkout typeshed
118-
uses: actions/checkout@v7
127+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
119128
with:
120129
path: typeshed
130+
persist-credentials: false
121131
- name: Checkout stub_uploader
122-
uses: actions/checkout@v7
132+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
123133
with:
124134
repository: typeshed-internal/stub_uploader
125135
path: stub_uploader
126-
- uses: astral-sh/setup-uv@v8.2.0
136+
persist-credentials: false
137+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
127138
with:
128139
version-file: "typeshed/requirements-tests.txt"
129140
- name: Run tests
@@ -141,7 +152,7 @@ jobs:
141152
permissions:
142153
issues: write
143154
steps:
144-
- uses: actions/github-script@v9
155+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
145156
with:
146157
github-token: ${{ secrets.GITHUB_TOKEN }}
147158
script: |

‎.github/workflows/meta_tests.yml‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,14 @@ jobs:
3535
platform: ["linux", "win32"]
3636
fail-fast: false
3737
steps:
38-
- uses: actions/checkout@v7
39-
- uses: astral-sh/setup-uv@v8.2.0
38+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
39+
with:
40+
persist-credentials: false
41+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
4042
with:
4143
version-file: "requirements-tests.txt"
42-
- run: |
44+
- name: Run check_typeshed_structure.py
45+
run: |
4346
uv run \
4447
--python=3.13 \
4548
--no-project \
@@ -55,16 +58,18 @@ jobs:
5558
python-platform: ["Linux", "Windows"]
5659
fail-fast: false
5760
steps:
58-
- uses: actions/checkout@v7
59-
- uses: actions/setup-python@v6
61+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
62+
with:
63+
persist-credentials: false
64+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
6065
with:
6166
python-version: "3.13"
62-
- uses: astral-sh/setup-uv@v8.2.0
67+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
6368
with:
6469
version-file: "requirements-tests.txt"
6570
- run: uv pip install -r requirements-tests.txt --system
6671
- name: Run pyright on typeshed
67-
uses: jakebailey/pyright-action@v3
72+
uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3
6873
with:
6974
version: PATH
7075
python-platform: ${{ matrix.python-platform }}
@@ -75,15 +80,18 @@ jobs:
7580
name: "stubsabot: dry run"
7681
runs-on: ubuntu-latest
7782
steps:
78-
- uses: actions/checkout@v7
79-
- uses: astral-sh/setup-uv@v8.2.0
83+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
84+
with:
85+
persist-credentials: false
86+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
8087
with:
8188
version-file: "requirements-tests.txt"
8289
- name: Git config
8390
run: |
8491
git config --global user.name stubsabot
8592
git config --global user.email '<>'
86-
- run: |
93+
- name: Run stubsabot
94+
run: |
8795
uv run \
8896
--python=3.13 \
8997
--no-project \

‎.github/workflows/mypy_primer.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,12 @@ jobs:
2525
shard-index: [0, 1, 2, 3, 4, 5]
2626
fail-fast: false
2727
steps:
28-
- uses: actions/checkout@v7
28+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2929
with:
3030
path: typeshed_to_test
3131
fetch-depth: 0
32-
- uses: actions/setup-python@v6
32+
persist-credentials: false
33+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
3334
with:
3435
python-version: "3.13"
3536
- name: Install dependencies
@@ -40,7 +41,7 @@ jobs:
4041
cd typeshed_to_test
4142
MYPY_VERSION=$(grep mypy== requirements-tests.txt | cut -d = -f 3)
4243
echo "new commit"
43-
git rev-list --format=%s --max-count=1 $GITHUB_SHA
44+
git rev-list --format=%s --max-count=1 "$GITHUB_SHA"
4445
git checkout -b upstream_main origin/main
4546
echo "base commit"
4647
git rev-list --format=%s --max-count=1 upstream_main
@@ -49,9 +50,9 @@ jobs:
4950
# fail action if exit code isn't zero or one
5051
(
5152
mypy_primer \
52-
--new v${MYPY_VERSION} --old v${MYPY_VERSION} \
53+
--new "v${MYPY_VERSION}" --old "v${MYPY_VERSION}" \
5354
--custom-typeshed-repo typeshed_to_test \
54-
--new-typeshed $GITHUB_SHA --old-typeshed upstream_main \
55+
--new-typeshed "$GITHUB_SHA" --old-typeshed upstream_main \
5556
--num-shards 6 --shard-index ${{ matrix.shard-index }} \
5657
--debug \
5758
--output concise \
@@ -62,15 +63,15 @@ jobs:
6263
run: |
6364
echo ${{ github.event.pull_request.number }} | tee pr_number.txt
6465
- name: Upload mypy_primer diff + PR number
65-
uses: actions/upload-artifact@v7
66+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
6667
if: ${{ matrix.shard-index == 0 }}
6768
with:
6869
name: mypy_primer_diffs-${{ matrix.shard-index }}
6970
path: |
7071
diff_${{ matrix.shard-index }}.txt
7172
pr_number.txt
7273
- name: Upload mypy_primer diff
73-
uses: actions/upload-artifact@v7
74+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
7475
if: ${{ matrix.shard-index != 0 }}
7576
with:
7677
name: mypy_primer_diffs-${{ matrix.shard-index }}
@@ -84,7 +85,7 @@ jobs:
8485
contents: read
8586
steps:
8687
- name: Merge artifacts
87-
uses: actions/upload-artifact/merge@v7
88+
uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
8889
with:
8990
name: mypy_primer_diffs
9091
pattern: mypy_primer_diffs-*

‎.github/workflows/mypy_primer_comment.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: mypy_primer (comment)
22

3-
on:
3+
# workflow_run is needed to comment on PRs from forks. This workflow only reads
4+
# artifacts as data; it never checks out or executes PR code.
5+
on: # zizmor: ignore[dangerous-triggers]
46
workflow_run:
57
workflows:
68
- mypy_primer
@@ -18,7 +20,7 @@ jobs:
1820
if: ${{ github.event.workflow_run.conclusion == 'success' }}
1921
steps:
2022
- name: Download diffs
21-
uses: actions/github-script@v9
23+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
2224
with:
2325
script: |
2426
const fs = require('fs');
@@ -44,7 +46,7 @@ jobs:
4446
4547
- name: Post comment
4648
id: post-comment
47-
uses: actions/github-script@v9
49+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
4850
with:
4951
github-token: ${{ secrets.GITHUB_TOKEN }}
5052
script: |
@@ -79,8 +81,7 @@ jobs:
7981
return prNumber
8082
8183
- name: Hide old comments
82-
# v0.4.0
83-
uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf
84+
uses: kanga333/comment-hider@c12bb20b48aeb8fc098e35967de8d4f8018fffdf # v0.4.0
8485
with:
8586
github_token: ${{ secrets.GITHUB_TOKEN }}
8687
leave_visible: 1

‎.github/workflows/stubsabot.yml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@ on:
55
schedule:
66
- cron: "0 0 * * *"
77

8-
permissions:
9-
contents: write
10-
issues: write
11-
pull-requests: write
8+
permissions: {}
129

1310
env:
1411
FORCE_COLOR: 1
@@ -18,16 +15,24 @@ jobs:
1815
name: Upgrade stubs with stubsabot
1916
if: github.repository == 'python/typeshed'
2017
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
pull-requests: write # Create, update, and label PRs.
2121
steps:
22-
- uses: actions/checkout@v7
22+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2323
with:
2424
# use an ssh key so that checks automatically run on stubsabot PRs
2525
ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }}
2626
fetch-depth: 0
27-
- uses: astral-sh/setup-uv@v8.2.0
27+
persist-credentials: true # stubsabot needs the SSH key to push branches.
28+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2829
with:
2930
version-file: "requirements-tests.txt"
30-
- name: git config
31+
# A compromised dependency in a test job on main could poison the shared
32+
# uv cache. Restoring it here could execute attacker-controlled code
33+
# with access to stubsabot's SSH key and GitHub token.
34+
enable-cache: false
35+
- name: Git config
3136
run: |
3237
git config --global user.name stubsabot
3338
git config --global user.email '<>'
@@ -47,8 +52,10 @@ jobs:
4752
runs-on: ubuntu-latest
4853
needs: [stubsabot]
4954
if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }}
55+
permissions:
56+
issues: write
5057
steps:
51-
- uses: actions/github-script@v9
58+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
5259
with:
5360
github-token: ${{ secrets.GITHUB_TOKEN }}
5461
script: |

‎.github/workflows/stubtest_stdlib.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,11 @@ jobs:
3939
fail-fast: false
4040

4141
steps:
42-
- uses: actions/checkout@v7
42+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
43+
with:
44+
persist-credentials: false
4345
- name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }}
44-
uses: actions/setup-python@v6
46+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
4547
with:
4648
python-version: ${{ matrix.python-version }}
4749
cache: pip

0 commit comments

Comments
 (0)